Security audit

ClawBoss - AI Productivity Coach

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent local productivity coach, but it needs Review because unchecked task-file paths can escape the intended memory folder and the install command runs a mutable npm latest package.

Review before installing. Prefer a pinned, reviewed package version instead of the latest npx command. Install only if you are comfortable with local storage of personal coaching data and automatic check-in updates, and avoid using it with untrusted plugins or manually edited state until task-file path containment is fixed.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/state-manager.js:468
Finding: Workspace Path Traversal Through Unvalidated Task File Paths
Content: View full analysis
Remediation: View remediation
.md` format. 6. Where symbolic links may be present, compare canonical paths using `fs.realpathSync()` before reading or writing. For new files, canonicalize the nearest existing parent directory. 7. Add automated tests covering traversal with `../`, mixed separators, symbolic links, absolute paths, and malformed persisted state. ]]>

T08 · Insecure Dependencies

Warning

Location: SKILL.md:202
Finding: Unpinned Package Execution Through Mutable npm Latest Tag
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (21)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The skill writes persistent coaching data to local memory files, including goals, motivation, progress logs, and insights, but the user-facing description does not clearly warn that personal data will be stored and updated automatically. This can cause users to disclose sensitive information under the assumption the interaction is ephemeral, increasing privacy and confidentiality risk.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The Heartbeat section describes scheduled automatic check-ins and state updates, but it does not present this behavior as a prominent warning requiring informed user consent. Automated background updates can modify memory files without a contemporaneous user prompt, which raises privacy, surprise-action, and integrity concerns in a coaching context handling sensitive personal data.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 97% confidence
Finding: The installation instruction uses npx clawboss@latest, which fetches and executes the newest published package without pinning to a known-good version. If the package is compromised, typosquatted, or a malicious update is published, users may immediately run attacker-controlled code during installation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: This JavaScript file defines all user-facing coaching prompts, persona messages, and helper outputs in Chinese only. Because there is no indication of user opt-in, language selection, or documented region-specific justification, the file creates a language/locale policy concern.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The pause command prints user-facing status and error messages only in Chinese, while other CLI text in the same file is in English. This creates an inconsistent forced-locale experience with no opt-in, fallback, or documented reason for restricting these messages to Chinese.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: User-facing strings throughout the skill are hard-coded in Chinese, including listing, errors, confirmations, and current-persona messages. This imposes a specific language choice without offering the user an opt-in or documenting that the skill is intentionally limited to Chinese-language use.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: All persona-switch confirmation messages are written only in Chinese, which enforces a single language experience regardless of user preference. Under the policy, locale/language constraints should be optional or explicitly justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: All persona names, descriptions, and generated messages in this file are written in Chinese, and the exported helpers always return those strings. There is no indication in code comments or interfaces that users can choose another language or that this locale restriction is intentionally limited to a Chinese-only deployment.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: This code returns user-facing messages entirely in Chinese, and similar Chinese-only strings appear throughout the file. That imposes a specific language on users without any visible opt-in or documented locale constraint, which matches the language/locale policy violation category.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The heading at L378-L380 sounds like an in-memory progress update, but the implementation loads a task file, injects a dated journal record, and saves the modified file back to disk at L390-L410. Because the documentation does not reflect this persistent side effect, it diverges from the actual behavior in a way that matters for developer intent and operational impact.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: This code persists user-supplied progress data directly into a task file without any visible confirmation, review step, or validation in this path. In an agent context, unintended invocation or manipulated inputs could silently alter user records, reducing integrity of stored plans and creating opportunities for content injection into downstream displays or parsers.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: Multiple user-visible strings in this file are written only in Chinese, such as the no-goals message and generated reflection content. This imposes a locale/language choice on all users without presenting an option or documenting a justified region-specific constraint.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The code persists free-form reflection answers and derived insights to application state without any visible notice, consent flow, retention control, or data minimization. Because reflections can contain sensitive personal, behavioral, health, or workplace information, silent storage increases privacy risk and potential harm if the state is later exposed, shared, or reused unexpectedly.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: This code embeds user-facing achievement names/descriptions in Chinese and also initializes the default timezone to Asia/Shanghai. Under the policy rule, forcing a specific language or locale without an explicit opt-in or documented regional justification is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: This is a real path traversal risk. Both loadTaskFile() and saveTaskFile() join an attacker-controlled taskPath with the workspace root, but they do not validate that the resolved path remains inside the intended tasks directory. An attacker who can influence taskPath could use values like '../' segments or absolute paths to read or overwrite arbitrary files accessible to the process, which is more dangerous in an agent skill that manipulates local workspace files.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: This code returns user-facing instructions in Chinese and continues that pattern throughout the skill, which effectively forces a specific language on users. The file does not provide any mechanism for locale selection or document that the skill is intentionally limited to Chinese-speaking users.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill creates task files and saves persistent state tied to user goals and session answers without presenting any user-facing notice or consent in this file. Because the stored content can include sensitive personal goals, motivations, obstacles, and emotional disclosures, silent persistence increases privacy risk and may violate user expectations or data-handling requirements.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The code tells users it will perform proactive daily check-ins, milestone reminders, and deadline notifications, but this file contains no scheduling, notification, or reminder implementation. This is dangerous because users may rely on non-existent support for time-sensitive goals, causing missed deadlines or a false sense of accountability and system capability.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The code constructs Intl.DateTimeFormat with the fixed locale 'en-US', which enforces a specific language/locale choice in natural-language-related formatting logic. The file does not indicate user choice or a documented region-specific requirement, so this is a locale policy concern under the stated rules.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 81% confidence
Finding: The function updates and saves user persona state, which is a persistent file/data write operation. While the action is part of the selector's purpose, this file does not include any explicit warning, confirmation, or user-facing disclosure that the choice will be saved to user state.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 79% confidence
Finding: The comment at L363-L365 presents the function as a simple summary helper, but the implementation at L366-L375 loads stored state from disk via stateManager.loadState() and derives user momentum data from it. This is not a major security contradiction, but the documentation obscures that the function performs state access rather than merely formatting already-provided data.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.